Re: Request for configuration assistance
"Russ Combs \(rucombs\) via Snort-users" <[email protected]> Wed, 29 Oct 2025 13:56:12 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <CO6PR11MB5635712D8D136387E0353F3BB7FAA@CO6PR11MB5635.namprd11.prod.outlook.com> |
--===============0937202902181318668== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_CO6PR11MB5635712D8D136387E0353F3BB7FAACO6PR11MB5635namp_" --_000_CO6PR11MB5635712D8D136387E0353F3BB7FAACO6PR11MB5635namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable You can use a bpf to filter the traffic by IP address: $ snort --bpf <filter> ... ________________________________ From: Snort-users <[email protected]> on behalf of Nick G= odwod via Snort-users <[email protected]> Sent: Friday, October 24, 2025 11:07 PM To: David Melczer <[email protected]> Cc: [email protected] <[email protected]> Subject: Re: [Snort-users] Request for configuration assistance You can do PCAP flows with Snort/Suricata, but its really just easier to se= tup a tcpdump dump to listen for specific traffic during a timeframe than m= ess with the Snort engine only. On Oct 23, 2025, at 13:42, David Melczer via Snort-users <snort-users@lists= .snort.org> wrote: I do know that Snort itself can do packet capture. Is there a way to speci= fy to only capture from a particular IP? Otherwise, the packet capture is = going to be enormous from an 80-person enterprise behind this IDS. Even wi= th just the IP, the packet capture will likely be large because the alerts = are triggering during a laptop Windows 11 imaging process=85 I could setup a wireshark system also if that would help. For now, I=92m taking the cheap way out though=85instead of turning on/off = the sensor during imaging (which was our previous strategy), I=92ve actuall= y commented out those 11 rules from my et_snort3.rules. At least I=92m not= flooding my IT team=92s emails but I do know it leaves a small blind spot= =85 -Dave David Z. Melczer | Director of Information Technology Greenbaum, Rowe, Smith & Davis LLP Delivery: 99 Wood Avenue South | Iselin, NJ | 08830 Mailing: P.O. Box 5600 | Woodbridge, NJ | 07095 T: 732.476.3284 | F: 732.476.3285 | vCard<http://www.greenbaumlaw.com/v= card-1999.vcf> <image001.jpg> greenbaumlaw.com<http://www.greenbaumlaw.com/> <image002.png><https://www.linkedin.com/company/greenbaum-rowe-smith-&-davi= s-llp?trk=3Dtop_nav_home> <image003.png><https://twitter.com/greenbaumlaw> <image004.png><https://www.facebook.com/greenbaumlaw?fref=3Dts&ref=3Dbr_tf> From: Al Lewis (allewi) <[email protected]<mailto:[email protected]>> Sent: Thursday, October 23, 2025 2:35 PM To: [email protected]<mailto:[email protected]>; David = Melczer <[email protected]<mailto:[email protected]>>; Al L= ewis (allewi) <[email protected]<mailto:[email protected]>> Subject: Re: Request for configuration assistance *** External Email Message *** The gid/sid should probably be removed as that doesnt match what you had li= sted below. Without a sample of the traffic it would be hard to replicate your exact is= sue. I will try it out and see if there is a problem. Albert Lewis Email: [email protected]<mailto:[email protected]> ________________________________ From: Snort-users <[email protected]<mailto:snort-users-b= [email protected]>> on behalf of Al Lewis (allewi) via Snort-users <sn= [email protected]<mailto:[email protected]>> Sent: Thursday, October 23, 2025 1:31 PM To: [email protected]<mailto:[email protected]> <snort-= [email protected]<mailto:[email protected]>>; David Melczer <= [email protected]<mailto:[email protected]>> Subject: Re: [Snort-users] Request for configuration assistance Do you have a sample of the traffic that is alerting (with the suppression = in place) that you can share? Albert Lewis Email: [email protected]<mailto:[email protected]> ________________________________ From: Snort-users <[email protected]<mailto:snort-users-b= [email protected]>> on behalf of David Melczer via Snort-users <snort-= [email protected]<mailto:[email protected]>> Sent: Thursday, October 23, 2025 12:46 PM To: [email protected]<mailto:[email protected]> <snort-= [email protected]<mailto:[email protected]>> Subject: [Snort-users] Request for configuration assistance Good day. We have a Snort3 sensor running 3.9.6.0<http://3.9.6.0/> with the ETOPEN ru= leset. The sensor runs on Debian 13, if that is relevant. Every time we g= o to image one of our laptops, we get several hundred ET alerts despite the= fact that I have what I believe is the proper suppression rules set in SNO= RT.LUA (the IP address of the machine generating these alerts is 172.19.8.2= 5). Here is what I believe to be a relevant clip: -------------------------------------------------------------------------- -- 6. configure filters --------------------------------------------------------------------------- include 'et_thresholds.lua' -- below are examples of filters -- each table is a list of records suppress =3D { -- don't want to any of see these { track =3D 'by_src', ip =3D '172.19.8.25' }, { track =3D 'by_dst', ip =3D '172.19.8.25' }, =85 } I=92ve tried different syntax that I=92ve seen online, including: { gid =3D 0, sid =3D 0, track =3D 'by_src', ip =3D '172.19.8.25' }, { gid =3D 0, sid =3D 0, track =3D 'by_dst', ip =3D '172.19.8.25' }, It would appear though that nothing I do suppresses error messages from thi= s IP=85 Does anyone have any idea how I might be able to accomplish this? Thank you very much in advance for any assistance you can provide. -Dave David Z. Melczer | Director of Information Technology Greenbaum, Rowe, Smith & Davis LLP Delivery: 99 Wood Avenue South | Iselin, NJ | 08830 Mailing: P.O. Box 5600 | Woodbridge, NJ | 07095 T: 732.476.3284 | F: 732.476.3285 | vCard<http://www.greenbaumlaw.com/v= card-1999.vcf> <image001.jpg> greenbaumlaw.com<http://www.greenbaumlaw.com/> <image002.png><https://www.linkedin.com/company/greenbaum-rowe-smith-&-davi= s-llp?trk=3Dtop_nav_home> <image003.png><https://twitter.com/greenbaumlaw> <image004.png><https://www.facebook.com/greenbaumlaw?fref=3Dts&ref=3Dbr_tf> Disclaimer This e-mail (including any attachments) is intended only for the exclusive = use of the individual to whom it is addressed. The information contained he= reinafter may be proprietary, confidential, privileged and exempt from disc= losure under applicable law. If the reader of this e-mail is not the intend= ed recipient or agent responsible for delivering the message to the intende= d recipient, the reader is hereby put on notice that any use, dissemination= , distribution or copying of this communication is strictly prohibited. If = the reader has received this communication in error, please immediately not= ify the sender by telephone (732-549-5600) or e-mail and delete all copies = of this e-mail and any attachments. Thank you. Disclaimer This e-mail (including any attachments) is intended only for the exclusive = use of the individual to whom it is addressed. The information contained he= reinafter may be proprietary, confidential, privileged and exempt from disc= losure under applicable law. If the reader of this e-mail is not the intend= ed recipient or agent responsible for delivering the message to the intende= d recipient, the reader is hereby put on notice that any use, dissemination= , distribution or copying of this communication is strictly prohibited. If = the reader has received this communication in error, please immediately not= ify the sender by telephone (732-549-5600) or e-mail and delete all copies = of this e-mail and any attachments. Thank you. _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort = news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-e= tiquette --_000_CO6PR11MB5635712D8D136387E0353F3BB7FAACO6PR11MB5635namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1= 252"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div style=3D"font-family: "Arial", "Helvetica", sans-s= erif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof"> You can use a bpf to filter the traffic by IP address:</div> <div style=3D"font-family: "Arial", "Helvetica", sans-s= erif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof"> <br> </div> <div style=3D"font-family: "Arial", "Helvetica", sans-s= erif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof"> $ snort --bpf <filter> ...</div> <div style=3D"font-family: "Arial", "Helvetica", sans-s= erif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof"> <br> </div> <div id=3D"appendonsend"></div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Snort-users <snort= [email protected]> on behalf of Nick Godwod via Snort-users= <[email protected]><br> <b>Sent:</b> Friday, October 24, 2025 11:07 PM<br> <b>To:</b> David Melczer <[email protected]><br> <b>Cc:</b> [email protected] <[email protected]><= br> <b>Subject:</b> Re: [Snort-users] Request for configuration assistance</fon= t> <div> </div> </div> <div style=3D"line-break:after-white-space">You can do PCAP flows with Snor= t/Suricata, but its really just easier to setup a tcpdump dump to listen fo= r specific traffic during a timeframe than mess with the Snort engine only.= <br id=3D"x_lineBreakAtBeginningOfMessage"> <div><br> <blockquote type=3D"cite"> <div>On Oct 23, 2025, at 13:42, David Melczer via Snort-users <snort-use= [email protected]> wrote:</div> <br class=3D"x_Apple-interchange-newline"> <div> <div class=3D"x_WordSection1" style=3D"font-family:Helvetica; font-size:12p= x; font-style:normal; font-variant-caps:normal; font-weight:400; letter-spa= cing:normal; text-align:start; text-indent:0px; text-transform:none; white-= space:normal; word-spacing:0px; text-decoration:none"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">I do know that Snort itself can do packet captu= re. Is there a way to specify to only capture from a particular IP?&n= bsp; Otherwise, the packet capture is going to be enormous from an 80-person enterprise behind this IDS. Even with = just the IP, the packet capture will likely be large because the alerts are= triggering during a laptop Windows 11 imaging process=85</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">I could setup a wireshark system also if that w= ould help.</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">For now, I=92m taking the cheap way out though= =85instead of turning on/off the sensor during imaging (which was our previ= ous strategy), I=92ve actually commented out those 11 rules from my et_snort3.rules. At least I=92m not flooding = my IT team=92s emails but I do know it leaves a small blind spot=85</span><= /div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">-Dave</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><b>= <span style=3D"font-size:11pt; font-family:"Arial Narrow",sans-se= rif; color:rgb(29,81,131)">David Z. Melczer <span class=3D"x_Apple-con= verted-space"> </span></span></b><span style=3D"font-size:11pt; font-f= amily:"Univers LT Std 57 Cn"; color:rgb(83,129,53)">|</span><span= style=3D"font-size:11pt; font-family:"Arial Narrow",sans-serif; = color:rgb(31,73,125)"><span class=3D"x_Apple-converted-space"> </span>= </span><span style=3D"font-size:9pt; font-family:"Arial Narrow",s= ans-serif; color:rgb(31,73,125)">Director of Information Technology</span><i><span style=3D"font-size:11pt; font-fam= ily:"Arial Narrow",sans-serif; color:rgb(31,73,125)"></span></i><= /div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:11.5pt"> <b><span style=3D"font-size:3pt; font-family:"Arial Narrow",sans-= serif; color:rgb(31,73,125)"> </span></b></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:11.5pt"> <b><span style=3D"font-size:10pt; font-family:"Arial Narrow",sans= -serif; color:rgb(31,73,125)">Greenbaum, Rowe, Smith & Davis LLP</span>= </b></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:11.5pt"> <span style=3D"font-size:10pt; font-family:"Arial Narrow",sans-se= rif; color:rgb(31,73,125)">Delivery: 99 Wood Avenue South<span class=3D"x_A= pple-converted-space"> </span></span><span style=3D"font-size:10pt; fo= nt-family:"Univers LT Std 57 Cn"; color:rgb(83,129,53)">|</span><= span style=3D"font-size:10pt; font-family:"Arial Narrow",sans-ser= if; color:rgb(31,73,125)"><span class=3D"x_Apple-converted-space"> </s= pan>Iselin, NJ<span class=3D"x_Apple-converted-space"> </span></span><span style= =3D"font-size:10pt; font-family:"Arial Narrow",sans-serif; color:= rgb(83,129,53)">|</span><span style=3D"font-size:10pt; font-family:"Ar= ial Narrow",sans-serif; color:rgb(31,73,125)"><span class=3D"x_Apple-c= onverted-space"> </span>08830</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:11.5pt"> <span style=3D"font-size:10pt; font-family:"Arial Narrow",sans-se= rif; color:rgb(31,73,125)">Mailing: P.O. Box 5600<span class=3D"x_Apple-con= verted-space"> </span></span><span style=3D"font-size:10pt; font-famil= y:"Arial Narrow",sans-serif; color:rgb(83,129,53)">|</span><span = style=3D"font-size:10pt; font-family:"Arial Narrow",sans-serif; c= olor:rgb(31,73,125)"><span class=3D"x_Apple-converted-space"> </span>W= oodbridge, NJ<span class=3D"x_Apple-converted-space"> </span></span><span style= =3D"font-size:10pt; font-family:"Arial Narrow",sans-serif; color:= rgb(83,129,53)">|</span><span style=3D"font-size:10pt; font-family:"Ar= ial Narrow",sans-serif; color:rgb(31,73,125)"><span class=3D"x_Apple-c= onverted-space"> </span>07095</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:11.5pt"> <span style=3D"font-size:10pt; font-family:"Arial Narrow",sans-se= rif; color:rgb(31,73,125)">T:</span><span style=3D"font-size:11pt; color:rg= b(31,73,125)"><span class=3D"x_Apple-converted-space"> </span></span><= span style=3D"font-size:10pt; font-family:"Arial Narrow",sans-ser= if; color:rgb(31,73,125)">732.476.3284</span><span style=3D"font-size:11pt;= color:rgb(31,73,125)"><span class=3D"x_Apple-converted-space"> </span= ></span><span style=3D"font-size:10pt; font-family:"Arial Narrow"= ,sans-serif; color:rgb(31,73,125)"> </span><span style=3D"font-size:10= pt; font-family:"Arial Narrow",sans-serif; color:rgb(83,129,53)">= |<span class=3D"x_Apple-converted-space"> </span></span><span style=3D= "font-size:10pt; font-family:"Arial Narrow",sans-serif; color:rgb= (31,73,125)"> F:</span><span style=3D"font-size:11pt; color:rgb(31,73,= 125)"><span class=3D"x_Apple-converted-space"> </span></span><span sty= le=3D"font-size:10pt; font-family:"Arial Narrow",sans-serif; colo= r:rgb(31,73,125)">732.476.3285 <span class=3D"x_Apple-converted-space"= > </span></span><span style=3D"font-size:10pt; font-family:"Arial= Narrow",sans-serif; color:rgb(83,129,53)">|<span class=3D"x_Apple-con= verted-space"> </span></span><span style=3D"font-size:10pt; font-famil= y:"Arial Narrow",sans-serif; color:rgb(29,81,131)"> </span><= span style=3D"font-size:11pt; color:rgb(31,73,125)"><a href=3D"http://www.g= reenbaumlaw.com/vcard-1999.vcf" style=3D"color:blue; text-decoration:underl= ine"><span style=3D"font-size:10pt; font-family:"Arial Narrow",sa= ns-serif; color:rgb(29,81,131)">vCard</span></a></span><span style=3D"font-= size:10pt; font-family:"Arial Narrow",sans-serif; color:rgb(31,73= ,125)"></span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:10pt"> <span style=3D"font-size:4pt; font-family:"Arial Narrow",sans-ser= if; color:rgb(29,81,131)"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:9pt; font-family:"Arial Narrow",sans-serif;= color:rgb(31,73,125)"><span id=3D"x_cid:[email protected]">&l= t;image001.jpg></span></span></div> <table class=3D"x_MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpaddin= g=3D"0" style=3D"margin-left:0.7pt; border-collapse:collapse"> <tbody> <tr style=3D"height:0.2in"> <td width=3D"144" style=3D"width:1.5in; padding:0in 0.7pt; height:0.2in"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; color:rgb(31,73,125)"><a href=3D"http://www.gre= enbaumlaw.com/" style=3D"color:blue; text-decoration:underline"><span style= =3D"font-size:12pt; font-family:"Arial Narrow",sans-serif; color:= rgb(237,125,49)">greenbaumlaw.com</span></a></span><u><span style=3D"font-f= amily:"Arial Narrow",sans-serif; color:rgb(83,129,53)"></span></u= ><span style=3D"font-family:"Arial Narrow",sans-serif; color:rgb(= 83,129,53)"></span></div> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in 0.7pt; height:0.2in"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><a = href=3D"https://www.linkedin.com/company/greenbaum-rowe-smith-&-davis-l= lp?trk=3Dtop_nav_home" style=3D"color:blue; text-decoration:underline"><spa= n style=3D"font-size:11pt; font-family:"Arial Narrow",sans-serif;= color:rgb(31,73,125); text-decoration:none"><span id=3D"x_cid:image002.png= @01DC442B.3F1E11D0"><image002.png></span></span></a><span style=3D"fo= nt-size:11pt; font-family:"Arial Narrow",sans-serif; color:rgb(29= ,81,131)"></span></div> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in 0.7pt; height:0.2in"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><a = href=3D"https://twitter.com/greenbaumlaw" style=3D"color:blue; text-decorat= ion:underline"><span style=3D"font-size:11pt; font-family:"Arial Narro= w",sans-serif; color:rgb(31,73,125); text-decoration:none"><span id=3D= "x_cid:[email protected]"><image003.png></span></span></= a><span style=3D"font-size:11pt; font-family:"Arial Narrow",sans-= serif; color:rgb(29,81,131)"></span></div> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in 0.7pt; height:0.2in"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><a = href=3D"https://www.facebook.com/greenbaumlaw?fref=3Dts&ref=3Dbr_tf" st= yle=3D"color:blue; text-decoration:underline"><span style=3D"font-size:11pt= ; font-family:"Arial Narrow",sans-serif; color:rgb(31,73,125); te= xt-decoration:none"><span id=3D"x_cid:[email protected]"><i= mage004.png></span></span></a><span style=3D"font-size:11pt; font-family= :"Arial Narrow",sans-serif; color:rgb(29,81,131)"></span></div> </td> </tr> </tbody> </table> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> </div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div> <div style=3D"border-width:1pt medium medium; border-style:solid none none;= border-color:rgb(225,225,225) currentcolor currentcolor; padding:3pt 0in 0= in"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><b>= <span style=3D"font-size:11pt; font-family:Calibri,sans-serif">From:</span>= </b><span style=3D"font-size:11pt; font-family:Calibri,sans-serif"><span cl= ass=3D"x_Apple-converted-space"> </span>Al Lewis (allewi) <<a href=3D"mailto:[email protected]" style=3D"color:blue= ; text-decoration:underline">[email protected]</a>><br> <b>Sent:</b><span class=3D"x_Apple-converted-space"> </span>Thursday, = October 23, 2025 2:35 PM<br> <b>To:</b><span class=3D"x_Apple-converted-space"> </span><a href=3D"m= ailto:[email protected]" style=3D"color:blue; text-decoration:und= erline">[email protected]</a>; David Melczer <<a href=3D"mailt= o:[email protected]" style=3D"color:blue; text-decoration:underline= ">[email protected]</a>>; Al Lewis (allewi) <<a href=3D"mailto:[email protected]" style=3D"color:b= lue; text-decoration:underline">[email protected]</a>><br> <b>Subject:</b><span class=3D"x_Apple-converted-space"> </span>Re: Req= uest for configuration assistance</span></div> </div> </div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif">&nb= sp;</div> <p class=3D"x_MsoNormal" style=3D"margin:0in 0in 12pt; font-size:12pt; font= -family:Aptos,sans-serif"> <b><span style=3D"font-size:13.5pt; font-family:Verdana,sans-serif; color:r= gb(102,102,102); background:yellow">*** External Email Message ***</span></= b></p> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-family:"Courier New"">The gid/sid should probabl= y be removed as that doesnt match what you had listed below.</span></div> </div> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-family:"Courier New""> </span></div> </div> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-family:"Courier New"">Without a sample of the tr= affic it would be hard to replicate your exact issue. I will try it out and= see if there is a problem.</span></div> </div> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-family:"Courier New""> </span></div> </div> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-family:"Courier New""> </span></div> </div> <div id=3D"x_Signature"> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-family:"Courier New""> </span></div> </div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><b>= <span style=3D"font-family:Courier; color:rgb(30,73,125)">Albert Lewis</spa= n></b><span style=3D"font-family:Courier; color:rgb(30,73,125)"></span></di= v> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-family:Courier; color:rgb(153,153,153)">Email:<span class= =3D"x_Apple-converted-space"> </span></span><u><span style=3D"font-fam= ily:Courier; color:rgb(128,27,128)"><a href=3D"mailto:[email protected]" sty= le=3D"color:blue; text-decoration:underline"><span style=3D"color:rgb(128,2= 7,128)">[email protected]</span></a></span></u><span style=3D"font-family:Co= urier; color:rgb(79,129,189)"> </span><span style=3D"font-size:11.5pt;= font-family:Courier; color:rgb(127,127,127)"></span></div> </div> <div class=3D"x_MsoNormal" align=3D"center" style=3D"margin:0in; font-size:= 12pt; font-family:Aptos,sans-serif; text-align:center"> <hr size=3D"2" width=3D"98%" align=3D"center"> </div> <div id=3D"x_divRplyFwdMsg"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><b>= <span style=3D"font-size:11pt; font-family:Calibri,sans-serif">From:</span>= </b><span style=3D"font-size:11pt; font-family:Calibri,sans-serif"><span cl= ass=3D"x_Apple-converted-space"> </span>Snort-users <<a href=3D"mailto:[email protected]" style=3D"color:= blue; text-decoration:underline">[email protected]</a>>= ; on behalf of Al Lewis (allewi) via Snort-users <<a href=3D"mailto:snor= [email protected]" style=3D"color:blue; text-decoration:underline">sn= [email protected]</a>><br> <b>Sent:</b><span class=3D"x_Apple-converted-space"> </span>Thursday, = October 23, 2025 1:31 PM<br> <b>To:</b><span class=3D"x_Apple-converted-space"> </span><a href=3D"m= ailto:[email protected]" style=3D"color:blue; text-decoration:und= erline">[email protected]</a><span class=3D"x_Apple-converted-spa= ce"> </span><<a href=3D"mailto:[email protected]" style= =3D"color:blue; text-decoration:underline">[email protected]</a>&= gt;; David Melczer <<a href=3D"mailto:[email protected]" style=3D"co= lor:blue; text-decoration:underline">[email protected]</a>><br> <b>Subject:</b><span class=3D"x_Apple-converted-space"> </span>Re: [Sn= ort-users] Request for configuration assistance</span></div> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif">&nb= sp;</div> </div> </div> <div> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-family:"Courier New"">Do you have a sample of th= e traffic that is alerting (with the suppression in place) that you can sha= re?</span></div> </div> <div id=3D"x_x_Signature"> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-family:"Courier New""> </span></div> </div> <p><b><span style=3D"font-family:Courier; color:rgb(30,73,125)">Albert Lewi= s</span></b><span style=3D"font-family:Courier; color:rgb(30,73,125)"></spa= n></p> <p><span style=3D"font-family:Courier; color:rgb(153,153,153)">Email:<span = class=3D"x_Apple-converted-space"> </span></span><u><span style=3D"fon= t-family:Courier; color:rgb(128,27,128)"><a href=3D"mailto:[email protected]= " style=3D"color:blue; text-decoration:underline"><span style=3D"color:rgb(= 128,27,128)">[email protected]</span></a></span></u><span style=3D"font-fami= ly:Courier; color:rgb(79,129,189)"> </span><span style=3D"font-size:11= .5pt; font-family:Courier; color:rgb(127,127,127)"></span></p> </div> <div class=3D"x_MsoNormal" align=3D"center" style=3D"margin:0in; font-size:= 12pt; font-family:Aptos,sans-serif; text-align:center"> <hr size=3D"2" width=3D"98%" align=3D"center"> </div> <div id=3D"x_x_divRplyFwdMsg"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><b>= <span style=3D"font-size:11pt; font-family:Calibri,sans-serif">From:</span>= </b><span style=3D"font-size:11pt; font-family:Calibri,sans-serif"><span cl= ass=3D"x_Apple-converted-space"> </span>Snort-users <<a href=3D"mailto:[email protected]" style=3D"color:= blue; text-decoration:underline">[email protected]</a>>= ; on behalf of David Melczer via Snort-users <<a href=3D"mailto:snort-us= [email protected]" style=3D"color:blue; text-decoration:underline">snort-= [email protected]</a>><br> <b>Sent:</b><span class=3D"x_Apple-converted-space"> </span>Thursday, = October 23, 2025 12:46 PM<br> <b>To:</b><span class=3D"x_Apple-converted-space"> </span><a href=3D"m= ailto:[email protected]" style=3D"color:blue; text-decoration:und= erline">[email protected]</a><span class=3D"x_Apple-converted-spa= ce"> </span><<a href=3D"mailto:[email protected]" style= =3D"color:blue; text-decoration:underline">[email protected]</a>&= gt;<br> <b>Subject:</b><span class=3D"x_Apple-converted-space"> </span>[Snort-= users] Request for configuration assistance</span></div> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif">&nb= sp;</div> </div> </div> <div> <div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">Good day.</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">We have a Snort3 sensor running<span class=3D"x= _Apple-converted-space"> </span><a href=3D"http://3.9.6.0/" style=3D"c= olor:blue; text-decoration:underline">3.9.6.0</a><span class=3D"x_Apple-con= verted-space"> </span>with the ETOPEN ruleset. The sensor runs on Debian 13, if that is relevan= t. Every time we go to image one of our laptops, we get several hundr= ed ET alerts despite the fact that I have what I believe is the proper supp= ression rules set in SNORT.LUA (the IP address of the machine generating these alerts is 172.19.8.25). Here is what= I believe to be a relevant clip:</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"">----------= ----------------------------------------------------------------</span></di= v> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"">-- 6. conf= igure filters</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"">----------= -----------------------------------------------------------------</span></d= iv> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New""> </sp= an></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"">include 'e= t_thresholds.lua'</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New""> </sp= an></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"">-- below a= re examples of filters</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"">-- each ta= ble is a list of records</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New""> </sp= an></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"">suppress = =3D</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"">{</span></= div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New""> &nbs= p; -- don't want to any of see these</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New""> &nbs= p; <span class=3D"x_Apple-converted-space"> </span><span style=3D= "background:yellow">{ track =3D 'by_src', ip =3D '172.19.8.25' },</span></s= pan></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"; background= :yellow"> { track =3D 'by_dst', ip =3D '172.19.8.25' },</= span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"">=85</span>= </div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"">}</span></= div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">I=92ve tried different syntax that I=92ve seen = online, including:</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New""> &nbs= p; <span class=3D"x_Apple-converted-space"> </span><span style=3D= "background:yellow">{ gid =3D 0, sid =3D 0, track =3D 'by_src', ip =3D '172= .19.8.25' },</span></span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; font-family:"Courier New"; background= :yellow"> { gid =3D 0, sid =3D 0, track =3D 'by_dst', ip = =3D '172.19.8.25' },</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">It would appear though that nothing I do suppre= sses error messages from this IP=85</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">Does anyone have any idea how I might be able t= o accomplish this?</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">Thank you very much in advance for any assistan= ce you can provide.</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt">-Dave</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><b>= <span style=3D"font-size:11pt; font-family:"Arial Narrow",sans-se= rif; color:rgb(29,81,131)">David Z. Melczer <span class=3D"x_Apple-con= verted-space"> </span></span></b><span style=3D"font-size:11pt; font-f= amily:"Univers LT Std 57 Cn"; color:rgb(83,129,53)">|</span><span= style=3D"font-size:11pt; font-family:"Arial Narrow",sans-serif; = color:rgb(31,73,125)"><span class=3D"x_Apple-converted-space"> </span>= </span><span style=3D"font-size:9pt; font-family:"Arial Narrow",s= ans-serif; color:rgb(31,73,125)">Director of Information Technology</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:11.5pt"> <b><span style=3D"font-size:3pt; font-family:"Arial Narrow",sans-= serif; color:rgb(31,73,125)"> </span></b></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:11.5pt"> <b><span style=3D"font-size:10pt; font-family:"Arial Narrow",sans= -serif; color:rgb(31,73,125)">Greenbaum, Rowe, Smith & Davis LLP</span>= </b></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:11.5pt"> <span style=3D"font-size:10pt; font-family:"Arial Narrow",sans-se= rif; color:rgb(31,73,125)">Delivery: 99 Wood Avenue South<span class=3D"x_A= pple-converted-space"> </span></span><span style=3D"font-size:10pt; fo= nt-family:"Univers LT Std 57 Cn"; color:rgb(83,129,53)">|</span><= span style=3D"font-size:10pt; font-family:"Arial Narrow",sans-ser= if; color:rgb(31,73,125)"><span class=3D"x_Apple-converted-space"> </s= pan>Iselin, NJ<span class=3D"x_Apple-converted-space"> </span></span><span style= =3D"font-size:10pt; font-family:"Arial Narrow",sans-serif; color:= rgb(83,129,53)">|</span><span style=3D"font-size:10pt; font-family:"Ar= ial Narrow",sans-serif; color:rgb(31,73,125)"><span class=3D"x_Apple-c= onverted-space"> </span>08830</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:11.5pt"> <span style=3D"font-size:10pt; font-family:"Arial Narrow",sans-se= rif; color:rgb(31,73,125)">Mailing: P.O. Box 5600<span class=3D"x_Apple-con= verted-space"> </span></span><span style=3D"font-size:10pt; font-famil= y:"Arial Narrow",sans-serif; color:rgb(83,129,53)">|</span><span = style=3D"font-size:10pt; font-family:"Arial Narrow",sans-serif; c= olor:rgb(31,73,125)"><span class=3D"x_Apple-converted-space"> </span>W= oodbridge, NJ<span class=3D"x_Apple-converted-space"> </span></span><span style= =3D"font-size:10pt; font-family:"Arial Narrow",sans-serif; color:= rgb(83,129,53)">|</span><span style=3D"font-size:10pt; font-family:"Ar= ial Narrow",sans-serif; color:rgb(31,73,125)"><span class=3D"x_Apple-c= onverted-space"> </span>07095</span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:11.5pt"> <span style=3D"font-size:10pt; font-family:"Arial Narrow",sans-se= rif; color:rgb(31,73,125)">T:</span><span style=3D"font-size:11pt; color:rg= b(31,73,125)"><span class=3D"x_Apple-converted-space"> </span></span><= span style=3D"font-size:10pt; font-family:"Arial Narrow",sans-ser= if; color:rgb(31,73,125)">732.476.3284</span><span style=3D"font-size:11pt;= color:rgb(31,73,125)"><span class=3D"x_Apple-converted-space"> </span= ></span><span style=3D"font-size:10pt; font-family:"Arial Narrow"= ,sans-serif; color:rgb(31,73,125)"> </span><span style=3D"font-size:10= pt; font-family:"Arial Narrow",sans-serif; color:rgb(83,129,53)">= |<span class=3D"x_Apple-converted-space"> </span></span><span style=3D= "font-size:10pt; font-family:"Arial Narrow",sans-serif; color:rgb= (31,73,125)"> F:</span><span style=3D"font-size:11pt; color:rgb(31,73,= 125)"><span class=3D"x_Apple-converted-space"> </span></span><span sty= le=3D"font-size:10pt; font-family:"Arial Narrow",sans-serif; colo= r:rgb(31,73,125)">732.476.3285 <span class=3D"x_Apple-converted-space"= > </span></span><span style=3D"font-size:10pt; font-family:"Arial= Narrow",sans-serif; color:rgb(83,129,53)">|<span class=3D"x_Apple-con= verted-space"> </span></span><span style=3D"font-size:10pt; font-famil= y:"Arial Narrow",sans-serif; color:rgb(29,81,131)"> </span><= span style=3D"font-size:11pt; color:rgb(31,73,125)"><a href=3D"http://www.g= reenbaumlaw.com/vcard-1999.vcf" style=3D"color:blue; text-decoration:underl= ine"><span style=3D"font-size:10pt; font-family:"Arial Narrow",sa= ns-serif; color:rgb(29,81,131)">vCard</span></a></span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif; lin= e-height:10pt"> <span style=3D"font-size:4pt; font-family:"Arial Narrow",sans-ser= if; color:rgb(29,81,131)"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:9pt; font-family:"Arial Narrow",sans-serif;= color:rgb(31,73,125)"><span id=3D"x_cid:[email protected]">&l= t;image001.jpg></span></span></div> <table class=3D"x_MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpaddin= g=3D"0" style=3D"margin-left:0.7pt; border-collapse:collapse"> <tbody> <tr style=3D"height:0.2in"> <td width=3D"144" style=3D"width:1.5in; padding:0in 0.7pt; height:0.2in"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt; color:rgb(31,73,125)"><a href=3D"http://www.gre= enbaumlaw.com/" style=3D"color:blue; text-decoration:underline"><span style= =3D"font-size:12pt; font-family:"Arial Narrow",sans-serif; color:= rgb(237,125,49)">greenbaumlaw.com</span></a></span><u><span style=3D"font-f= amily:"Arial Narrow",sans-serif; color:rgb(83,129,53)"></span></u= ></div> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in 0.7pt; height:0.2in"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><a = href=3D"https://www.linkedin.com/company/greenbaum-rowe-smith-&-davis-l= lp?trk=3Dtop_nav_home" style=3D"color:blue; text-decoration:underline"><spa= n style=3D"font-size:11pt; font-family:"Arial Narrow",sans-serif;= color:rgb(31,73,125); text-decoration:none"><span id=3D"x_cid:image002.png= @01DC442B.3F1E11D0"><image002.png></span></span></a></div> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in 0.7pt; height:0.2in"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><a = href=3D"https://twitter.com/greenbaumlaw" style=3D"color:blue; text-decorat= ion:underline"><span style=3D"font-size:11pt; font-family:"Arial Narro= w",sans-serif; color:rgb(31,73,125); text-decoration:none"><span id=3D= "x_cid:[email protected]"><image003.png></span></span></= a></div> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in 0.7pt; height:0.2in"> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><a = href=3D"https://www.facebook.com/greenbaumlaw?fref=3Dts&ref=3Dbr_tf" st= yle=3D"color:blue; text-decoration:underline"><span style=3D"font-size:11pt= ; font-family:"Arial Narrow",sans-serif; color:rgb(31,73,125); te= xt-decoration:none"><span id=3D"x_cid:[email protected]"><i= mage004.png></span></span></a></div> </td> </tr> </tbody> </table> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif"><sp= an style=3D"font-size:11pt"> </span></div> <div style=3D"margin:0in; font-size:12pt; font-family:Aptos,sans-serif">&nb= sp;</div> </div> <p class=3D"x_MsoNormal" style=3D"margin:0in 0in 12pt; font-size:12pt; font= -family:Aptos,sans-serif"> </p> <p><b><span style=3D"font-size:10pt; font-family:Verdana,sans-serif; color:= rgb(102,102,102)">Disclaimer</span></b><span style=3D"font-size:10pt; font-= family:Verdana,sans-serif; color:rgb(102,102,102)"></span></p> <p><span style=3D"font-size:8pt; font-family:Verdana,sans-serif; color:rgb(= 102,102,102)">This e-mail (including any attachments) is intended only for = the exclusive use of the individual to whom it is addressed. The informatio= n contained hereinafter may be proprietary, confidential, privileged and exempt from disclosure under applicable law. = If the reader of this e-mail is not the intended recipient or agent respons= ible for delivering the message to the intended recipient, the reader is he= reby put on notice that any use, dissemination, distribution or copying of this communication is strictly p= rohibited. If the reader has received this communication in error, please i= mmediately notify the sender by telephone (732-549-5600) or e-mail and dele= te all copies of this e-mail and any attachments. Thank you.</span></p> </div> </div> </div> <br style=3D"font-family:Helvetica; font-size:12px; font-style:normal; font= -variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:st= art; text-indent:0px; text-transform:none; white-space:normal; word-spacing= :0px; text-decoration:none"> <br style=3D"font-family:Helvetica; font-size:12px; font-style:normal; font= -variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:st= art; text-indent:0px; text-transform:none; white-space:normal; word-spacing= :0px; text-decoration:none"> <p style=3D"font-style:normal; font-variant-caps:normal; font-weight:400; l= etter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text= -transform:none; white-space:normal; widows:auto; word-spacing:0px; text-de= coration:none; font-family:Verdana; font-size:10pt; color:rgb(102,102,102)"= > <b>Disclaimer</b></p> <p style=3D"font-style:normal; font-variant-caps:normal; font-weight:400; l= etter-spacing:normal; orphans:auto; text-align:start; text-indent:0px; text= -transform:none; white-space:normal; widows:auto; word-spacing:0px; text-de= coration:none; font-family:Verdana; font-size:8pt; color:rgb(102,102,102)"> This e-mail (including any attachments) is intended only for the exclusive = use of the individual to whom it is addressed. The information contained he= reinafter may be proprietary, confidential, privileged and exempt from disc= losure under applicable law. If the reader of this e-mail is not the intended recipient or agent responsib= le for delivering the message to the intended recipient, the reader is here= by put on notice that any use, dissemination, distribution or copying of th= is communication is strictly prohibited. If the reader has received this communication in error, please immediately= notify the sender by telephone (732-549-5600) or e-mail and delete all cop= ies of this e-mail and any attachments. Thank you.</p> <span style=3D"font-family:Helvetica; font-size:12px; font-style:normal; fo= nt-variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:= start; text-indent:0px; text-transform:none; white-space:normal; word-spaci= ng:0px; text-decoration:none; float:none; display:inline!important">_______= ________________________________________</span><br style=3D"font-family:Hel= vetica; font-size:12px; font-style:normal; font-variant-caps:normal; font-w= eight:400; letter-spacing:normal; text-align:start; text-indent:0px; text-t= ransform:none; white-space:normal; word-spacing:0px; text-decoration:none"> <span style=3D"font-family:Helvetica; font-size:12px; font-style:normal; fo= nt-variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:= start; text-indent:0px; text-transform:none; white-space:normal; word-spaci= ng:0px; text-decoration:none; float:none; display:inline!important">Snort-u= sers mailing list</span><br style=3D"font-family:Helvetica; font-size:12px; fon= t-style:normal; font-variant-caps:normal; font-weight:400; letter-spacing:n= ormal; text-align:start; text-indent:0px; text-transform:none; white-space:= normal; word-spacing:0px; text-decoration:none"> <span style=3D"font-family:Helvetica; font-size:12px; font-style:normal; fo= nt-variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:= start; text-indent:0px; text-transform:none; white-space:normal; word-spaci= ng:0px; text-decoration:none; float:none; display:inline!important">Snort-u= [email protected]</span><br style=3D"font-family:Helvetica; font-size:12= px; font-style:normal; font-variant-caps:normal; font-weight:400; letter-sp= acing:normal; text-align:start; text-indent:0px; text-transform:none; white= -space:normal; word-spacing:0px; text-decoration:none"> <span style=3D"font-family:Helvetica; font-size:12px; font-style:normal; fo= nt-variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:= start; text-indent:0px; text-transform:none; white-space:normal; word-spaci= ng:0px; text-decoration:none; float:none; display:inline!important">Go to this URL to change user options or unsubscribe:</span><br style=3D"font= -family:Helvetica; font-size:12px; font-style:normal; font-variant-caps:nor= mal; font-weight:400; letter-spacing:normal; text-align:start; text-indent:= 0px; text-transform:none; white-space:normal; word-spacing:0px; text-decora= tion:none"> <span style=3D"font-family:Helvetica; font-size:12px; font-style:normal; fo= nt-variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:= start; text-indent:0px; text-transform:none; white-space:normal; word-spaci= ng:0px; text-decoration:none; float:none; display:inline!important">https:/= /lists.snort.org/mailman/listinfo/snort-users</span><br style=3D"font-famil= y:Helvetica; font-size:12px; font-style:normal; font-variant-caps:normal; f= ont-weight:400; letter-spacing:normal; text-align:start; text-indent:0px; t= ext-transform:none; white-space:normal; word-spacing:0px; text-decoration:n= one"> <br style=3D"font-family:Helvetica; font-size:12px; font-style:normal; font= -variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:st= art; text-indent:0px; text-transform:none; white-space:normal; word-spacing= :0px; text-decoration:none"> <span class=3D"x_Apple-tab-span" style=3D"font-family:Helvetica; font-size:= 12px; font-style:normal; font-variant-caps:normal; font-weight:400; letter-= spacing:normal; text-align:start; text-indent:0px; text-transform:none; whi= te-space:pre; word-spacing:0px; text-decoration:none"></span><span style=3D= "font-family:Helvetica; font-size:12px; font-style:normal; font-variant-cap= s:normal; font-weight:400; letter-spacing:normal; text-align:start; text-in= dent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-d= ecoration:none; float:none; display:inline!important">To unsubscribe, send an email to:</span><br style=3D"font-family:Helvetica; f= ont-size:12px; font-style:normal; font-variant-caps:normal; font-weight:400= ; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:= none; white-space:normal; word-spacing:0px; text-decoration:none"> <span class=3D"x_Apple-tab-span" style=3D"font-family:Helvetica; font-size:= 12px; font-style:normal; font-variant-caps:normal; font-weight:400; letter-= spacing:normal; text-align:start; text-indent:0px; text-transform:none; whi= te-space:pre; word-spacing:0px; text-decoration:none"></span><span style=3D= "font-family:Helvetica; font-size:12px; font-style:normal; font-variant-cap= s:normal; font-weight:400; letter-spacing:normal; text-align:start; text-in= dent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-d= ecoration:none; float:none; display:inline!important">snort-users-leave@lis= ts.snort.org</span><br style=3D"font-family:Helvetica; font-size:12px; font= -style:normal; font-variant-caps:normal; font-weight:400; letter-spacing:no= rmal; text-align:start; text-indent:0px; text-transform:none; white-space:n= ormal; word-spacing:0px; text-decoration:none"> <br style=3D"font-family:Helvetica; font-size:12px; font-style:normal; font= -variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:st= art; text-indent:0px; text-transform:none; white-space:normal; word-spacing= :0px; text-decoration:none"> <span style=3D"font-family:Helvetica; font-size:12px; font-style:normal; fo= nt-variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:= start; text-indent:0px; text-transform:none; white-space:normal; word-spaci= ng:0px; text-decoration:none; float:none; display:inline!important">Please visit http://blog.snort.org to stay current on all the latest Snort news!<= /span><br style=3D"font-family:Helvetica; font-size:12px; font-style:normal= ; font-variant-caps:normal; font-weight:400; letter-spacing:normal; text-al= ign:start; text-indent:0px; text-transform:none; white-space:normal; word-s= pacing:0px; text-decoration:none"> <br style=3D"font-family:Helvetica; font-size:12px; font-style:normal; font= -variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:st= art; text-indent:0px; text-transform:none; white-space:normal; word-spacing= :0px; text-decoration:none"> <span style=3D"font-family:Helvetica; font-size:12px; font-style:normal; fo= nt-variant-caps:normal; font-weight:400; letter-spacing:normal; text-align:= start; text-indent:0px; text-transform:none; white-space:normal; word-spaci= ng:0px; text-decoration:none; float:none; display:inline!important">Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquet= te</span></div> </blockquote> </div> <br> </div> </body> </html> --_000_CO6PR11MB5635712D8D136387E0353F3BB7FAACO6PR11MB5635namp_-- --===============0937202902181318668== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============0937202902181318668==--